This informal CPD article, ‘When the Incident Becomes Inside Information: MAR Article 17 After the Listing Act Rewrite’, was provided by Nikolas Demetriades, CFA, holds the CySEC Advanced and AML certifications. He is the founder of CPDs.Academy, a CPD training platform delivering compliance education for professionals in EU-regulated financial services.
On 16 July 2026 the German supervisor BaFin fined TeamViewer SE EUR 240,000. The company had suffered a cyberattack, and BaFin concluded that the fact should have been disclosed to the public without delay as inside information. The provision infringed was the first subparagraph of Article 17(1) of the Market Abuse Regulation (1). Six weeks before that decision, on 5 June 2026, Article 17 was rewritten. The relevant Listing Act amendments to Article 17 began to apply on that date, changing both what has to be disclosed and the conditions on which disclosure may be delayed (2), (3). A firm reading the decision for guidance is reading about a duty that has since moved.
What the decision turned on
BaFin's published notice is brief. The fine was imposed on 16 July 2026 and published on 20 July. It records that the company was the victim of a cyberattack, and that the fact ought to have reached the market without delay as inside information (1). Two things the notice does not state are worth naming, because they are easy to assume. It does not give the date of the attack, and it does not say whether the decision has become final (1).
The Listing Act also rebuilt the sanctions article, and Article 17 is no longer bracketed with Article 16. For an Article 17 infringement by a legal person, Member States must provide for a maximum administrative pecuniary sanction set at no less than 2% of total annual turnover, taken from the last accounts the management body has approved. Where the competent authority takes the view that the turnover-based figure would be disproportionately low against the circumstances in Article 31(1), points (a), (b) and (d) to (h), it must be able to impose at least EUR 2,500,000 instead, and where the issuer is an SME a Member State may allow at least EUR 1,000,000 as the alternative (2), (3). Member States were to have those measures in place by 5 June 2026 (3). The amount is less telling than the proposition underneath it. A cyber incident can itself be information the market is entitled to have.
When an incident becomes inside information
Article 7 supplies the definition. Inside information must be precise, still unpublished, connected directly or indirectly with an issuer or an instrument, and of a kind whose release would likely move prices (2). Information is precise where it indicates a set of circumstances which exists or may reasonably be expected to come into existence, or an event which has occurred or may reasonably be expected to occur, and is specific enough to enable a conclusion to be drawn as to the possible effect on prices (2). A significant effect means information a reasonable investor would be likely to use as part of the basis of an investment decision (2).
Both limbs call for a fact-specific assessment, though precision can be particularly difficult in the early stages of an incident. A firm that has just detected an intrusion usually knows something has happened and very little about its extent, and the instinct is to wait for a complete picture. Article 7(2) does not require one. That an event has already occurred is relevant, since the provision reaches circumstances which exist and events which have occurred, but occurrence by itself does not make the information precise. It must still be specific enough to allow a conclusion to be drawn about the possible effect of that event on prices (2). The interval between knowing that an attack happened and knowing what it cost is where the judgement has to be made rather than deferred.
The rewrite that began to apply in June
Article 4(3) of the Listing Act sets 5 June 2026 as the application date for the relevant amendments to Article 17 (3). The most consequential of them carves out the steps along the way. Where a process under Article 7(2) and (3) works towards particular circumstances or a particular event, the intermediate steps connected with bringing that about now fall outside the duty to inform the public, and only the final circumstances or the final event must be disclosed, as soon as possible once they occur (3). An intermediate step that independently met the criteria of inside information used to be disclosable subject to a delay decision. It now sits outside the obligation.
Alongside it, a new Article 17(1a) requires an issuer to keep information meeting the criteria of inside information confidential until disclosure, turning what was a condition of delaying into a freestanding duty (3). The delay test changed too. Article 17(4) still allows an issuer to delay on its own responsibility where immediate disclosure is likely to prejudice its legitimate interests and confidentiality can be maintained, but the middle condition no longer asks whether delay is likely to mislead the public. It asks whether the withheld information is in contrast with the latest public announcement or other type of communication by the issuer on the same matter to which that information refers (2), (3). Article 17(4a) confirms that withholding intermediate steps under paragraph 1 is not subject to the paragraph 4 conditions at all (3).
Where confidentiality is lost, disclosure is required as soon as possible, and that trigger now extends to information about intermediate steps withheld under paragraph 1, expressly where a rumour is accurate enough to show that confidentiality has gone (3). The delegated act contemplated by Article 17(12) is no longer a future event. Commission Delegated Regulation (EU) 2026/789 was adopted on 8 April 2026 and published in the Official Journal on 16 July. It entered into force on 19 July, one day before the BaFin decision was publicised (4). Its Annex I carries a non-exhaustive list of final events and final circumstances in protracted processes, Annex II lists situations in which inside information is in contrast with an issuer's latest public announcement, and Annex III identifies the other types of communication that count for that test (4).
Commission Delegated Regulation (EU)
Whether a cyberattack is a protracted process
The tempting reading is that an investigation into an intrusion is a process, that each finding is an intermediate step, and that nothing need be said until the assessment closes. The texts point the other way.
The delegated regulation describes a protracted process as a series of actions, steps or decisions spread in time which need to be performed, at least in part, by an issuer, to achieve an intended objective or result (4). An external attack is not something the issuer performs in order to achieve an objective. The Listing Act recitals point the same way, treating a non-protracted one-off event or set of circumstances, notably where its occurrence does not depend on the issuer, as disclosable as soon as the issuer becomes aware of it (3). A cyberattack sits close to the paradigm of an event whose occurrence does not depend on the issuer.
None of that decides every scenario. The delegated regulation does not address each kind of incident, its list operates without prejudice to whether a given process gives rise to inside information at all, and remediation an issuer itself plans and carries out may raise different questions (4). Individual cases stay fact-sensitive. A firm hoping that an open forensic investigation suspends the obligation should not count on it.
Earlier statements about security can bear on whether delay remains available. Since the test measures the withheld information against the issuer's most recent public statement on the same subject, and against the other kinds of communication the delegated regulation identifies, a firm that has published assurances about resilience may find that route closed (2), (3). Whether it is closed depends on the wording of the earlier communication, its subject matter and how closely it relates to the new information, which is what makes Annexes II and III worth reading before the question arises rather than during it (4).
What it means for firms
The difficulty is organisational rather than legal. Incident response and market disclosure usually sit with different people, and a security severity scale is built around containment and recovery rather than around Article 7. A firm can run a technically competent response and still miss the moment its disclosure duty crystallised, because nobody in the room was asking that question.
An incident-response procedure therefore needs a point at which the disclosure question is put to the people who can answer it, early and on the record, rather than after remediation. Recording the assessment as it is made is prudent practice rather than a legal precondition, and it materially improves an issuer's ability to explain months afterwards why information was not yet regarded as precise. That is worth distinguishing from the places where MAR does require a record. An issuer that delays under Article 17(4) must tell the competent authority that disclosure was delayed and provide a written explanation of how the conditions were met, immediately after the information reaches the public, although Member States may instead provide for that explanation to be supplied only on request (2), (3).
The confidentiality duty in Article 17(1a) runs from the moment information meets the criteria, which has a direct bearing on how widely an incident is circulated internally while a disclosure decision is still open (3).
Article 17 applies to an issuer that has requested or approved the admission of its financial instruments to trading on a regulated market. Where those instruments trade only on an MTF or an OTF, it applies to an issuer that has approved the trading of its instruments on an MTF or an OTF, or has requested admission to trading on an MTF (2). The rule is not confined to financial firms: TeamViewer is a software company. Because the duty attaches to the issuer rather than to whoever runs the systems, outsourcing the infrastructure moves the incident without moving the obligation.
Closing thoughts
The decision and the amended text approach the same problem from opposite ends. BaFin's fine shows that a cyberattack can be treated as inside information and that failing to disclose it in time can carry a financial consequence. The rewritten Article 17 narrows what must be said about the steps along the way, makes confidentiality a standing duty, and measures any delay against what the issuer has already told the market (2), (3). Neither makes the judgement easier. Somebody still has to decide, early and on an incomplete view of an incident, whether the market is entitled to know. What the case supplies is a number for getting that wrong.
We hope this article was helpful. For more information from CPDs.Academy, please visit their CPD Member Directory page. Alternatively, you can go to the CPD Industry Hubs for more articles, courses and events relevant to your Continuing Professional Development requirements.
References
(1) Bundesanstalt fuer Finanzdienstleistungsaufsicht (BaFin), administrative fine imposed on TeamViewer SE on 16 July 2026 and published on 20 July 2026, for infringement of the first subparagraph of Article 17(1) of Regulation (EU) No 596/2014.
(2) Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse (Market Abuse Regulation), including Article 7 on inside information, Article 17 on public disclosure of inside information, Article 30(2) on administrative sanctions and other administrative measures, and Article 31(1) on the circumstances to be taken into account in determining them.
(3) Regulation (EU) 2024/2809 of the European Parliament and of the Council of 23 October 2024 amending, among others, Regulation (EU) No 596/2014 (the Listing Act), OJ L, 14.11.2024. Article 2, points (6) and (14), amend Articles 17 and 30 of Regulation (EU) No 596/2014. Article 4(3) provides that Article 2, point (6)(a), (b), (c) and (e) apply from 5 June 2026, and Article 4(4) requires Member States to comply with Article 2, point (14)(a) by the same date.
(4) Commission Delegated Regulation (EU) 2026/789 of 8 April 2026 supplementing Regulation (EU) No 596/2014 as regards disclosure of inside information in protracted processes and delay of disclosure, OJ L, 16.7.2026, in force from 19 July 2026. Annex I sets out a non-exhaustive list of final events or final circumstances in protracted processes, Annex II a non-exhaustive list of situations in which inside information is in contrast with the latest public announcement or other type of communication, and Annex III those other types of communication.
